@pixelbyte-software/pixcode 1.50.9 → 1.51.0

package/scripts/smoke/hermes-mcp-pixcode-roundtrip.mjs

@@ -10,6 +10,8 @@ const seen = [];
 const providerMcpUpserts = [];
 const terminalLaunches = [];
 const providerOutputReads = [];
+const providerInputWrites = [];
+const gatewayRequests = [];
 
 function readJson(req) {
   return new Promise((resolve, reject) => {
@@ -48,6 +50,17 @@ const server = createServer(async (req, res) => {
     return;
   }
 
+  if (req.method === 'GET' && url.pathname === '/api/public/manifest') {
+    res.end(JSON.stringify({
+      name: 'Pixcode Public API',
+      groups: [
+        { id: 'projects', basePath: '/api/projects', scopes: ['projects:read', 'projects:write'] },
+        { id: 'providers', basePath: '/api/providers', scopes: ['providers:read', 'providers:write'] },
+      ],
+    }));
+    return;
+  }
+
   if (req.method === 'GET' && url.pathname === '/api/providers/codex/auth/status') {
     res.end(JSON.stringify({ data: { provider: 'codex', installed: true, authenticated: true } }));
     return;
@@ -85,6 +98,37 @@ const server = createServer(async (req, res) => {
     return;
   }
 
+  if (req.method === 'GET' && url.pathname === '/api/orchestration/hermes/diagnostics') {
+    res.end(JSON.stringify({
+      ok: true,
+      model: { provider: 'openai-codex', default: 'gpt-5.5' },
+      config: {
+        active: {
+          toolsets: ['hermes-cli', 'mcp-pixcode'],
+          pixcodeMcp: { toolCount: 12, missingTools: [] },
+        },
+      },
+      cron: { toolsetAvailable: true, gatewayJobsApi: { ok: true, status: 200 } },
+      issues: [],
+    }));
+    return;
+  }
+
+  if (req.method === 'POST' && url.pathname === '/api/orchestration/hermes/gateway/request') {
+    const body = await readJson(req);
+    gatewayRequests.push(body);
+    res.end(JSON.stringify({
+      ok: true,
+      endpoint: body.endpoint,
+      body: {
+        jobs: [
+          { job_id: 'job_1', name: 'Morning repo check', schedule: '0 9 * * *' },
+        ],
+      },
+    }));
+    return;
+  }
+
   if (req.method === 'POST' && url.pathname === '/api/orchestration/hermes/terminal-launches') {
     const body = await readJson(req);
     terminalLaunches.push(body);
@@ -127,28 +171,7 @@ const server = createServer(async (req, res) => {
         provider: 'codex',
         projectPath: '/root/pixcode',
         terminalState: 'idle',
-        output: 'OpenAI Codex\n› /init\n',
-      },
-      {
-        active: true,
-        provider: 'codex',
-        projectPath: '/root/pixcode',
-        terminalState: 'idle',
-        output: 'OpenAI Codex\n› /init\n',
-      },
-      {
-        active: true,
-        provider: 'codex',
-        projectPath: '/root/pixcode',
-        terminalState: 'idle',
-        output: 'OpenAI Codex\n› /init\n',
-      },
-      {
-        active: true,
-        provider: 'codex',
-        projectPath: '/root/pixcode',
-        terminalState: 'idle',
-        output: 'OpenAI Codex\n› /init\n',
+        output: 'OpenAI Codex\n› /init\n\n• Ran npm test\n\n› Implement {feature}\n',
       },
       {
         active: true,
@@ -162,6 +185,13 @@ const server = createServer(async (req, res) => {
     return;
   }
 
+  if (req.method === 'POST' && url.pathname === '/api/shell/sessions/provider-input') {
+    const body = await readJson(req);
+    providerInputWrites.push(body);
+    res.end(JSON.stringify({ ok: true, wrote: true, provider: body.provider, launchId: body.launchId }));
+    return;
+  }
+
   res.statusCode = 404;
   res.end(JSON.stringify({ error: url.pathname }));
 });
@@ -218,6 +248,7 @@ const child = spawn(process.execPath, [path.join(repoRoot, 'scripts/hermes/pixco
     ...process.env,
     PIXCODE_BASE_URL: baseUrl,
     PIXCODE_API_KEY: apiKey,
+    PIXCODE_MCP_READBACK_IDLE_STABLE_MS: '500',
   },
   stdio: ['pipe', 'pipe', 'pipe'],
 });
@@ -230,6 +261,12 @@ try {
   assert(toolNames.includes('pixcode_get_provider_status'), 'provider status tool missing');
   assert(toolNames.includes('pixcode_get_hermes_gateway_status'), 'Hermes gateway status tool missing');
   assert(toolNames.includes('pixcode_probe_hermes_gateway'), 'Hermes gateway probe tool missing');
+  assert(toolNames.includes('pixcode_get_hermes_diagnostics'), 'Hermes diagnostics tool missing');
+  assert(toolNames.includes('pixcode_get_api_manifest'), 'Pixcode API manifest tool missing');
+  assert(toolNames.includes('pixcode_api_request'), 'Pixcode generic API request tool missing');
+  assert(toolNames.includes('pixcode_hermes_gateway_request'), 'Hermes gateway request proxy tool missing');
+  assert(toolNames.includes('pixcode_manage_hermes_cron'), 'Hermes cron management tool missing');
+  assert(toolNames.includes('pixcode_send_cli_input'), 'Provider terminal input tool missing');
 
   const projects = await callMcp(child, 'tools/call', { name: 'pixcode_list_projects', arguments: {} });
   assert.match(projects.content[0].text, /224/, 'projects response should include file count');
@@ -243,6 +280,35 @@ try {
   });
   assert.match(probe.content[0].text, /"ok": true/, 'gateway probe should return ok');
 
+  const diagnostics = await callMcp(child, 'tools/call', {
+    name: 'pixcode_get_hermes_diagnostics',
+    arguments: { projectPath: '/root/pixcode' },
+  });
+  assert.match(diagnostics.content[0].text, /mcp-pixcode/, 'Hermes diagnostics should expose active toolsets.');
+  assert.match(diagnostics.content[0].text, /"toolsetAvailable": true/, 'Hermes diagnostics should expose cron toolset availability.');
+
+  const manifest = await callMcp(child, 'tools/call', { name: 'pixcode_get_api_manifest', arguments: {} });
+  assert.match(manifest.content[0].text, /Pixcode Public API/, 'API manifest tool should expose Pixcode API docs to Hermes.');
+
+  const apiRequest = await callMcp(child, 'tools/call', {
+    name: 'pixcode_api_request',
+    arguments: { method: 'GET', path: '/api/projects' },
+  });
+  assert.match(apiRequest.content[0].text, /"name": "pixcode"/, 'generic Pixcode API tool should call allowlisted local API paths.');
+
+  const cronJobs = await callMcp(child, 'tools/call', {
+    name: 'pixcode_hermes_gateway_request',
+    arguments: { method: 'GET', endpoint: '/api/jobs', projectPath: '/root/pixcode' },
+  });
+  assert.match(cronJobs.content[0].text, /Morning repo check/, 'Hermes gateway request tool should expose API-server jobs/cron endpoints.');
+  assert.equal(gatewayRequests[0].endpoint, '/api/jobs', 'Gateway request should keep the requested Hermes endpoint.');
+
+  const cronList = await callMcp(child, 'tools/call', {
+    name: 'pixcode_manage_hermes_cron',
+    arguments: { action: 'list', projectPath: '/root/pixcode' },
+  });
+  assert.match(cronList.content[0].text, /Morning repo check/, 'Hermes cron helper should list managed Hermes jobs.');
+
   const launch = await callMcp(child, 'tools/call', {
     name: 'pixcode_open_cli_terminal',
     arguments: { provider: 'codex', projectPath: '/root/pixcode', prompt: 'smoke' },
@@ -285,6 +351,14 @@ try {
   assert.match(blockedLaunch.content[0].text, /"reason": "not_installed"/, 'uninstalled provider response should explain the block');
   assert.equal(terminalLaunches.length, 2, 'Only installed Codex provider launches should be created');
 
+  const inputWrite = await callMcp(child, 'tools/call', {
+    name: 'pixcode_send_cli_input',
+    arguments: { provider: 'codex', projectPath: '/root/pixcode', input: 'selam', submit: true, launchId: 2 },
+  });
+  assert.match(inputWrite.content[0].text, /"wrote": true/, 'MCP should be able to submit input to an existing visible provider terminal.');
+  assert.equal(providerInputWrites[0].input, 'selam', 'Provider input body should preserve exact user input.');
+  assert.equal(providerInputWrites[0].submit, true, 'Provider input should submit by default when requested.');
+
   assert(seen.every((entry) => entry.auth === `Bearer ${apiKey}`), 'all MCP calls should use the Pixcode bearer key');
   console.log('hermes MCP Pixcode roundtrip smoke passed');
 } finally {

package/scripts/smoke/hermes-rest-chat-api.mjs

@@ -5,6 +5,8 @@ import { fileURLToPath } from 'node:url';
 
 import {
   ensureHermesGateway,
+  readHermesDiagnostics,
+  requestHermesGateway,
   runHermesGatewayPrompt,
   stopHermesGateway,
 } from '../../server/services/hermes-gateway.js';
@@ -89,6 +91,14 @@ const server = http.createServer(async (req, res) => {
     }));
     return;
   }
+  if (req.method === 'GET' && url.pathname === '/api/jobs') {
+    res.end(JSON.stringify({
+      jobs: [
+        { job_id: 'job_smoke', name: 'Pixcode cron smoke', schedule: 'every 1h' },
+      ],
+    }));
+    return;
+  }
   res.statusCode = 404;
   res.end(JSON.stringify({ error: url.pathname }));
 });
@@ -120,10 +130,31 @@ try {
     throw new Error(`Hermes REST chat did not use responses: ${JSON.stringify(run)}`);
   }
 
+  const jobs = await requestHermesGateway(projectPath, {
+    method: 'GET',
+    endpoint: '/api/jobs',
+  });
+  if (!jobs.ok || !String(JSON.stringify(jobs.body)).includes('Pixcode cron smoke')) {
+    throw new Error(`Hermes gateway jobs API did not proxy cron jobs: ${JSON.stringify(jobs)}`);
+  }
+
+  const diagnostics = await readHermesDiagnostics({ projectPath, hermesHome });
+  if (!diagnostics.config?.active?.toolsets?.includes('hermes-cli') || !diagnostics.config.active.toolsets.includes('mcp-pixcode')) {
+    throw new Error(`Hermes diagnostics did not see the full toolset config: ${JSON.stringify(diagnostics.config?.active)}`);
+  }
+  if (!diagnostics.cron?.gatewayJobsApi?.ok) {
+    throw new Error(`Hermes diagnostics did not verify cron jobs API: ${JSON.stringify(diagnostics.cron)}`);
+  }
+
   console.log(JSON.stringify({
     ok: true,
     transport: run.transport,
     message: run.message,
+    jobs: jobs.body,
+    diagnostics: {
+      toolsets: diagnostics.config.active.toolsets,
+      cronOk: diagnostics.cron.gatewayJobsApi.ok,
+    },
   }, null, 2));
 } finally {
   stopHermesGateway(projectPath);

package/scripts/smoke/hermes-rest-gateway.mjs

@@ -12,6 +12,8 @@ const settingsTab = read('src/components/settings/view/tabs/HermesSettingsTab.ts
 assert.match(service, /export async function ensureHermesGateway/, 'Pixcode should expose an API-managed Hermes gateway starter.');
 assert.match(service, /export async function probeHermesGateway/, 'Pixcode should probe Hermes through its REST API.');
 assert.match(service, /export async function runHermesGatewayPrompt/, 'Pixcode should submit Hermes prompts through the managed REST gateway.');
+assert.match(service, /export async function requestHermesGateway/, 'Pixcode should proxy documented Hermes gateway endpoints such as /api/jobs.');
+assert.match(service, /export async function readHermesDiagnostics/, 'Pixcode should expose redacted Hermes diagnostics for config, auth, MCP, gateway, and cron state.');
 assert.match(service, /export function stopHermesGateway/, 'Pixcode should be able to stop a managed Hermes gateway process.');
 assert.match(service, /\/v1\/chat\/completions/, 'Hermes UI chat should use the documented OpenAI-compatible chat completions endpoint first.');
 assert.match(service, /\/v1\/responses/, 'Hermes UI chat should use the stateful OpenAI-compatible responses endpoint before legacy chat fallback.');
@@ -36,6 +38,8 @@ assert.match(routes, /router\.get\('\/gateway\/status'/, 'Hermes router should e
 assert.match(routes, /router\.post\('\/gateway\/start'/, 'Hermes router should expose gateway start.');
 assert.match(routes, /router\.post\('\/gateway\/probe'/, 'Hermes router should expose a REST probe endpoint.');
 assert.match(routes, /router\.post\('\/gateway\/chat'/, 'Hermes router should expose a REST chat endpoint.');
+assert.match(routes, /router\.post\('\/gateway\/request'/, 'Hermes router should expose a generic documented gateway request endpoint.');
+assert.match(routes, /router\.get\('\/diagnostics'/, 'Hermes router should expose integration diagnostics.');
 assert.match(routes, /router\.post\('\/gateway\/stop'/, 'Hermes router should expose gateway stop.');
 assert.match(routes, /ensureHermesGateway/, 'Hermes router should use the managed gateway service.');
 assert.match(routes, /probeHermesGateway/, 'Hermes router should use the REST probe service.');
@@ -45,12 +49,22 @@ assert.match(routes, /probeExisting:\s*false/, 'Hermes chat should reuse a runni
 
 assert.match(mcpServer, /pixcode_get_hermes_gateway_status/, 'Pixcode MCP should let Hermes inspect gateway status.');
 assert.match(mcpServer, /pixcode_probe_hermes_gateway/, 'Pixcode MCP should let Hermes trigger a REST probe.');
+assert.match(mcpServer, /pixcode_get_hermes_diagnostics/, 'Pixcode MCP should let Hermes read redacted integration diagnostics.');
+assert.match(mcpServer, /pixcode_get_api_manifest/, 'Pixcode MCP should let Hermes discover Pixcode API docs.');
+assert.match(mcpServer, /pixcode_api_request/, 'Pixcode MCP should let Hermes call authenticated Pixcode APIs.');
+assert.match(mcpServer, /pixcode_hermes_gateway_request/, 'Pixcode MCP should let Hermes call documented gateway APIs.');
+assert.match(mcpServer, /pixcode_manage_hermes_cron/, 'Pixcode MCP should expose Hermes cron job management.');
+assert.match(mcpServer, /pixcode_send_cli_input/, 'Pixcode MCP should let Hermes continue an existing visible CLI terminal.');
 assert.match(configureMcp, /pixcode_get_hermes_gateway_status/, 'Hermes MCP config should include gateway status tool.');
 assert.match(configureMcp, /pixcode_probe_hermes_gateway/, 'Hermes MCP config should include gateway probe tool.');
+assert.match(configureMcp, /pixcode_get_hermes_diagnostics/, 'Hermes MCP config should include diagnostics tool.');
+assert.match(configureMcp, /pixcode_manage_hermes_cron/, 'Hermes MCP config should include cron management tool.');
 assert.match(configureMcp, /mcp-pixcode/, 'Hermes MCP config should enable the Pixcode MCP toolset for the real CLI.');
+assert.match(configureMcp, /hermes-cli/, 'Hermes MCP config should keep the native Hermes CLI toolset enabled for cron/files/terminal tools.');
 
 assert.match(settingsTab, /gateway\/status/, 'Hermes settings should read gateway status.');
 assert.match(settingsTab, /gateway\/start/, 'Hermes settings should start the REST gateway via API.');
 assert.match(settingsTab, /gateway\/probe/, 'Hermes settings should run REST probe via API.');
+assert.match(settingsTab, /diagnostics/, 'Hermes settings should render diagnostics from the server.');
 
 console.log('hermes REST gateway smoke passed');

package/scripts/smoke/hermes-settings-commands.mjs

@@ -27,23 +27,21 @@ assert.match(
 assert.match(settingsTab, /command:\s*'hermes model'/, 'Hermes settings should expose the interactive provider/model wizard.');
 assert.match(settingsTab, /command:\s*'hermes auth'/, 'Hermes settings should expose the credential manager.');
 assert.match(settingsTab, /command:\s*'hermes setup tools'/, 'Hermes settings should expose tool setup.');
+assert.match(settingsTab, /command:\s*'hermes cron status'/, 'Hermes settings should expose scheduler/cron status.');
+assert.match(settingsTab, /command:\s*'hermes mcp'/, 'Hermes settings should expose MCP server management.');
 assert.match(settingsTab, /command:\s*'hermes doctor'/, 'Hermes settings should expose diagnostics.');
+assert.match(settingsTab, /command:\s*'hermes update --yes'/, 'Hermes settings should expose a non-interactive updater.');
 assert.match(settingsTab, /command:\s*'hermes sessions browse'/, 'Hermes settings should open the interactive sessions browser, not the sessions usage screen.');
+assert.match(settingsTab, /\/api\/orchestration\/hermes\/diagnostics/, 'Hermes settings should read integration diagnostics.');
+assert.match(settingsTab, /diagnosticsTitle/, 'Hermes settings should render a diagnostics panel.');
+assert.match(settingsTab, /diagnosticsMcpTools/, 'Hermes settings diagnostics should show Pixcode MCP tool counts.');
+assert.match(settingsTab, /diagnosticsCron/, 'Hermes settings diagnostics should show cron availability.');
+assert.match(settingsTab, /Pixcode Hermes REST health check/, 'Hermes REST probe should submit a real prompt so provider/auth failures are visible.');
 assert.match(
   settingsTab,
   /pixcode:hermes-terminal[\s\S]+command[\s\S]+title/,
   'Hermes settings should dispatch command and title to the workbench terminal.',
 );
-assert.match(
-  settingsTab,
-  /ensureGatewayReady/,
-  'Hermes settings should automatically start/probe the REST API gateway when Hermes is installed.',
-);
-assert.match(
-  settingsTab,
-  /startIfNeeded:\s*true/,
-  'Hermes settings should start the REST API gateway through Pixcode when checking gateway readiness.',
-);
 assert.match(
   settingsModal,
   /<HermesSettingsTab onClose=\{onClose\} \/>/,
@@ -66,8 +64,8 @@ assert.match(
 );
 assert.match(
   workbench,
-  /HERMES_DEFAULT_COMMAND\s*=\s*'hermes --yolo --toolsets mcp-pixcode'/,
-  'Hermes terminal should default to Pixcode MCP-only toolsets so provider CLIs stay visible inside Pixcode.',
+  /HERMES_DEFAULT_COMMAND\s*=\s*'hermes --yolo'/,
+  'Hermes terminal should not override toolsets on the command line; Pixcode writes hermes-cli plus Pixcode MCP into Hermes config before launch.',
 );
 assert.match(
   serverIndex,
@@ -86,8 +84,18 @@ assert.match(
 );
 assert.match(
   pixcodeMcpServer,
-  /startIfNeeded:\s*args\.startIfNeeded !== false/,
-  'Pixcode MCP gateway probes should start the managed REST gateway by default unless Hermes explicitly opts out.',
+  /pixcode_send_cli_input/,
+  'Pixcode MCP should expose a direct input tool for continuing an existing visible CLI terminal.',
+);
+assert.match(
+  pixcodeMcpServer,
+  /pixcode_manage_hermes_cron/,
+  'Pixcode MCP should expose Hermes cron management through the managed gateway.',
+);
+assert.match(
+  pixcodeMcpServer,
+  /pixcode_get_hermes_diagnostics/,
+  'Pixcode MCP should expose redacted Hermes integration diagnostics.',
 );
 assert.match(
   pixcodeMcpServer,
@@ -109,11 +117,6 @@ assert.match(
   /lastStrongBusy[\s\S]+lastPrompt[\s\S]+\?\s*'busy'\s*:\s*'idle'/,
   'Codex readback should ignore weak spinner remnants once the prompt has returned.',
 );
-assert.match(
-  pixcodeMcpServer,
-  /codex_prompt_input_pending/,
-  'Codex readback should not treat a prompt line with typed-but-unsubmitted input as final output.',
-);
 assert.match(
   serverIndex,
   /lastStrongBusy[\s\S]+lastPrompt[\s\S]+\?\s*'busy'\s*:\s*'idle'/,
@@ -129,11 +132,6 @@ assert.match(
   /requestedLaunchId[\s\S]+session\.hermesLaunchId === requestedLaunchId/,
   'Provider output API should filter by Hermes terminal launch id when supplied.',
 );
-assert.match(
-  serverIndex,
-  /existingSession\.hermesLaunchId = hermesLaunchId \|\| existingSession\.hermesLaunchId/,
-  'Reused visible provider PTYs should be rebound to the latest Hermes launch id so MCP readback follows the current request.',
-);
 assert.match(
   serverIndex,
   /lifecycleState/,
@@ -269,26 +267,6 @@ assert.match(
   /writeTerminalStartupInput/,
   'Shell backend should submit Hermes startup input directly into reused visible PTYs.',
 );
-assert.match(
-  serverIndex,
-  /queueTerminalStartupInput/,
-  'Shell backend should queue Hermes startup input until the visible provider terminal is ready instead of writing blindly after a fixed delay.',
-);
-assert.match(
-  serverIndex,
-  /STARTUP_INPUT_READY_TIMEOUT_MS/,
-  'Queued provider startup input should have a bounded readiness timeout.',
-);
-assert.match(
-  serverIndex,
-  /resolveProviderTerminalState[\s\S]+terminalState === 'busy'/,
-  'Queued startup input should inspect the provider terminal state and avoid sending while the CLI is busy.',
-);
-assert.match(
-  serverIndex,
-  /\\x15/,
-  'Provider startup input should clear any half-typed prompt line before typing the requested work.',
-);
 assert.match(
   serverIndex,
   /startupInputDelivery === 'terminal'[\s\S]+writeTerminalStartupInput/,

package/scripts/smoke/pixcode-workbench-1-48.mjs

@@ -74,7 +74,7 @@ assert.match(workbench, /isPlainShell/, 'Bottom terminal should open the selecte
 assert.doesNotMatch(workbench, /HERMES_AGENT_START_COMMAND/, 'Hermes Agent should not launch from the bottom terminal through a server-side sentinel.');
 assert.doesNotMatch(workbench, /HermesApiChatPanel|HermesTerminalTranscript/, 'Hermes Agent should use the real PTY terminal UI, not a custom REST chat transcript.');
 assert.doesNotMatch(workbench, /REST POST \/|transport=|response=|gateway=http/, 'Hermes terminal UI must not expose REST debug internals to the user.');
-assert.match(workbench, /HERMES_DEFAULT_COMMAND = 'hermes --yolo --toolsets mcp-pixcode'/, 'Hermes Agent bottom panel should launch the actual `hermes` CLI with Pixcode MCP-only tools.');
+assert.match(workbench, /HERMES_DEFAULT_COMMAND = 'hermes --yolo'/, 'Hermes Agent bottom panel should launch the actual `hermes` CLI and leave toolsets to the Pixcode-managed Hermes config.');
 assert.match(workbench, /HERMES_HISTORY_COMMAND = 'hermes sessions browse'/, 'Hermes terminal history should open the native interactive session picker.');
 assert.match(workbench, /onOpenHistory=\{openHermesHistory\}/, 'Hermes terminal header should wire its history button to the native Hermes sessions command.');
 assert.match(workbench, /Pixcode MCP Live/, 'Hermes terminal should show a user-facing Pixcode MCP live badge.');

package/scripts/smoke/vscode-workbench-polish.mjs

@@ -324,8 +324,8 @@ assert.doesNotMatch(
 
 assert.match(
   workbench,
-  /HERMES_DEFAULT_COMMAND = 'hermes --yolo --toolsets mcp-pixcode'/,
-  'Hermes Agent should launch the Hermes CLI directly in bypass mode with only the Pixcode MCP toolset.',
+  /HERMES_DEFAULT_COMMAND = 'hermes --yolo'/,
+  'Hermes Agent should launch the Hermes CLI directly in bypass mode and rely on Pixcode-written config for hermes-cli + mcp-pixcode.',
 );
 
 assert.match(

package/server/index.js

@@ -641,6 +641,40 @@ function quoteShellArgForPlatform(value) {
 }
 
 const HERMES_CLI_COMMAND_PATTERN = /^hermes(?:\s+[A-Za-z0-9._:/=@+-]+)*\s*$/;
+const HERMES_AGENT_API_SCOPES = [
+    'auth:read',
+    'auth:write',
+    'diagnostics:read',
+    'files:read',
+    'files:write',
+    'git:read',
+    'git:write',
+    'hermes:mcp',
+    'hermes:gateway',
+    'notifications:read',
+    'notifications:write',
+    'orchestration:read',
+    'orchestration:write',
+    'plugins:read',
+    'plugins:write',
+    'projects:read',
+    'projects:write',
+    'providers:read',
+    'providers:write',
+    'remote:read',
+    'remote:write',
+    'sessions:read',
+    'sessions:write',
+    'settings:read',
+    'settings:write',
+    'telegram:read',
+    'telegram:write',
+    'terminal:launch',
+    'updates:read',
+    'updates:write',
+    'webhooks:read',
+    'webhooks:write',
+];
 
 function isHermesCliCommand(command) {
     return typeof command === 'string' && HERMES_CLI_COMMAND_PATTERN.test(command.trim());
@@ -663,16 +697,15 @@ function getOrCreateHermesApiKey(userId) {
         .getApiKeys(userId)
         .find((key) => key.key_name === 'Hermes Agent MCP' && key.is_active);
     if (existing?.api_key) {
+        const existingScopes = Array.isArray(existing.scopes) ? existing.scopes : [];
+        const missingScopes = HERMES_AGENT_API_SCOPES.filter((scope) => !existingScopes.includes(scope));
+        if (missingScopes.length > 0 && existing.id) {
+            apiKeysDb.updateApiKeyScopes(userId, existing.id, [...existingScopes, ...missingScopes]);
+        }
         return existing.api_key;
     }
 
-    return apiKeysDb.createApiKey(userId, 'Hermes Agent MCP', [
-        'hermes:mcp',
-        'hermes:gateway',
-        'projects:read',
-        'providers:read',
-        'terminal:launch',
-    ]).apiKey;
+    return apiKeysDb.createApiKey(userId, 'Hermes Agent MCP', HERMES_AGENT_API_SCOPES).apiKey;
 }
 
 // Single WebSocket server that handles both paths
@@ -815,6 +848,72 @@ app.get('/api/shell/sessions/provider-output', authenticateToken, (req, res) =>
     });
 });
 
+app.post('/api/shell/sessions/provider-input', authenticateToken, (req, res) => {
+    const provider = String(req.body?.provider || 'claude');
+    const projectPath = typeof req.body?.projectPath === 'string' && req.body.projectPath.trim()
+        ? req.body.projectPath.trim()
+        : null;
+    const launchId = Number.parseInt(String(req.body?.launchId || ''), 10);
+    const requestedLaunchId = Number.isFinite(launchId) && launchId > 0 ? launchId : null;
+    const input = typeof req.body?.input === 'string' ? req.body.input : '';
+    const submit = req.body?.submit !== false;
+
+    if (!SHELL_CLI_PROVIDERS.has(provider)) {
+        return res.status(400).json({ error: 'Unsupported provider' });
+    }
+
+    const requestedProjectPath = projectPath ? path.resolve(projectPath) : null;
+    let matchedSession = null;
+    for (const session of ptySessionsMap.values()) {
+        if (
+            session?.provider === provider &&
+            !session?.isPlainShell &&
+            session?.pty &&
+            session.lifecycleState === 'running' &&
+            (!requestedProjectPath || path.resolve(session.projectPath || os.homedir()) === requestedProjectPath) &&
+            (!requestedLaunchId || session.hermesLaunchId === requestedLaunchId)
+        ) {
+            if (!matchedSession || (session.updatedAt || 0) > (matchedSession.updatedAt || 0)) {
+                matchedSession = session;
+            }
+        }
+    }
+
+    if (!matchedSession?.pty) {
+        return res.status(404).json({
+            ok: false,
+            provider,
+            projectPath: requestedProjectPath,
+            launchId: requestedLaunchId,
+            wrote: false,
+            message: 'No running provider terminal session found for this project.',
+        });
+    }
+
+    const data = submit ? normalizeTerminalStartupInput(input) : input;
+    try {
+        matchedSession.pty.write(data);
+        matchedSession.updatedAt = Date.now();
+        res.json({
+            ok: true,
+            provider,
+            projectPath: path.resolve(matchedSession.projectPath || os.homedir()),
+            sessionId: matchedSession.sessionId || null,
+            launchId: matchedSession.hermesLaunchId || null,
+            wrote: true,
+            submitted: submit,
+            bytes: Buffer.byteLength(data),
+        });
+    } catch (error) {
+        res.status(500).json({
+            ok: false,
+            provider,
+            wrote: false,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+});
+
 // Authentication routes (public)
 app.use('/api/auth', authRoutes);
 

package/server/modules/orchestration/hermes/hermes.routes.ts

@@ -16,6 +16,8 @@ import {
   ensureHermesGateway,
   getHermesGatewayStatus,
   probeHermesGateway,
+  readHermesDiagnostics,
+  requestHermesGateway,
   runHermesGatewayPrompt,
   stopHermesGateway,
 } from '@/services/hermes-gateway.js';
@@ -280,6 +282,72 @@ export function createHermesRouter(options: HermesRouterOptions = {}): Router {
     }
   });
 
+  router.post('/gateway/request', async (req: PixcodeRequest, res) => {
+    const body = (req.body ?? {}) as Record<string, unknown>;
+    const projectPath = typeof body.projectPath === 'string' && body.projectPath.trim()
+      ? body.projectPath.trim()
+      : undefined;
+    const endpoint = typeof body.endpoint === 'string' ? body.endpoint : body.path;
+    const method = typeof body.method === 'string' ? body.method : 'GET';
+
+    try {
+      if (body.startIfNeeded === true) {
+        const apiKey = options.createHermesApiKey?.(readUserId(req)) ?? null;
+        if (!apiKey) {
+          res.status(500).json({
+            error: {
+              code: 'HERMES_API_KEY_UNAVAILABLE',
+              message: 'Pixcode could not create a Hermes MCP API key for this user.',
+            },
+          });
+          return;
+        }
+        await ensureHermesGateway({
+          appRoot: options.appRoot ?? process.cwd(),
+          pixcodeApiKey: apiKey,
+          pixcodeBaseUrl: resolveHermesMcpBaseUrl(),
+          projectPath,
+        });
+      }
+
+      const gatewayResponse = await requestHermesGateway(projectPath, {
+        endpoint,
+        method,
+        body: body.body,
+        timeoutMs: typeof body.timeoutMs === 'number' ? body.timeoutMs : undefined,
+      });
+      res.status(gatewayResponse.ok ? 200 : 502).json(gatewayResponse);
+    } catch (error) {
+      res.status(500).json({
+        error: {
+          code: 'HERMES_GATEWAY_REQUEST_FAILED',
+          message: error instanceof Error ? error.message : String(error),
+        },
+      });
+    }
+  });
+
+  router.get('/diagnostics', async (req, res) => {
+    const projectPath = typeof req.query.projectPath === 'string' && req.query.projectPath.trim()
+      ? req.query.projectPath.trim()
+      : undefined;
+
+    try {
+      const diagnostics = await readHermesDiagnostics({
+        appRoot: options.appRoot ?? process.cwd(),
+        projectPath,
+      });
+      res.status(diagnostics.ok ? 200 : 503).json(diagnostics);
+    } catch (error) {
+      res.status(500).json({
+        error: {
+          code: 'HERMES_DIAGNOSTICS_FAILED',
+          message: error instanceof Error ? error.message : String(error),
+        },
+      });
+    }
+  });
+
   router.post('/gateway/stop', (req, res) => {
     const body = (req.body ?? {}) as Record<string, unknown>;
     const projectPath = typeof body.projectPath === 'string' ? body.projectPath : null;